[anotherhue]

One can use the TPM so at least the secrets can't be mass exported. Doesn't stop keylogging individual ones of course (but a browser extension might).